[androolloyd]

Block validation could accept invalid Taproot signatures, reuse spent UTXOs, and skip witness/contextual checks. This change routes Taproot verification through the real verifier with all prevouts, rejects double-spends, fixes UTXO cache/undo behavior, validates witness and Signet commitments, and persists validated tips atomically while processing downloaded blocks in chain order.

It replaces BIP324 and BIP352 placeholder cryptography with implementations checked against upstream vectors, adds BIP39 NFKD normalization and a working CLI RPC client, and sets up locked dependencies, Rust 1.88, CI, container checks, and fuzz workflows. Workspace formatting and machine-applicable Clippy fixes are included.

Validation: 3,352 workspace tests pass; all official BIP352 cases and BIP324 packet-vector rows pass; formatting, all-feature Clippy, minimal-feature builds, native release, Docker build/CLI smoke, and all fuzz-target builds pass. A bounded parser fuzz run completed 1,613,391 executions without a crash. Dependency audit reports zero vulnerabilities/unsound warnings; the QMDB bincode maintenance warning remains.

This PR remains draft while the runtime backend work in docs/BUILD_PLAN.md continues. Shared sync/RPC state, persistent reorgs, Core parity acceptance, Electrum, snapshot/LevelDB backends, Erlay, stage providers, and devnet still need implementation. Passing unit tests does not establish full Core parity.

API changes: UtxoSet returns owned entries; silent-payment APIs require actual key/prevout information; v2 decryption takes complete encrypted packets; Rust raw-pointer FFI callers must use unsafe.